1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
|
// Copyright 2017 Google Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// Package gcpkms provides integration with the GCP Cloud KMS.
// Tink APIs work with GCP and AWS KMS.
package gcpkms
import (
"context"
"errors"
"fmt"
"runtime"
"strings"
"google.golang.org/api/cloudkms/v1"
"google.golang.org/api/option"
"github.com/tink-crypto/tink-go/v2/core/registry"
"github.com/tink-crypto/tink-go/v2/tink"
)
const (
gcpPrefix = "gcp-kms://"
)
var (
errCred = errors.New("invalid credential path")
tinkUserAgent = "Tink/" + tink.Version + " Golang/" + runtime.Version()
)
// gcpClient represents a client that connects to the GCP KMS backend.
type gcpClient struct {
keyURIPrefix string
kms *cloudkms.Service
}
var _ registry.KMSClient = (*gcpClient)(nil)
// NewClientWithOptions returns a new GCP KMS client with provided Google API
// options to handle keys with uriPrefix prefix.
// uriPrefix must have the following format: 'gcp-kms://[:path]'.
func NewClientWithOptions(ctx context.Context, uriPrefix string, opts ...option.ClientOption) (registry.KMSClient, error) {
if !strings.HasPrefix(strings.ToLower(uriPrefix), gcpPrefix) {
return nil, fmt.Errorf("uriPrefix must start with %s", gcpPrefix)
}
opts = append(opts, option.WithUserAgent(tinkUserAgent))
kmsService, err := cloudkms.NewService(ctx, opts...)
if err != nil {
return nil, err
}
return &gcpClient{
keyURIPrefix: uriPrefix,
kms: kmsService,
}, nil
}
// Supported true if this client does support keyURI
func (c *gcpClient) Supported(keyURI string) bool {
return strings.HasPrefix(keyURI, c.keyURIPrefix)
}
// GetAEAD gets an AEAD backend by keyURI.
func (c *gcpClient) GetAEAD(keyURI string) (tink.AEAD, error) {
if !c.Supported(keyURI) {
return nil, errors.New("unsupported keyURI")
}
keyName := strings.TrimPrefix(keyURI, gcpPrefix)
return newGCPAEAD(keyName, c.kms), nil
}
|
